# FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

Unauthenticated Socket.IO clients can emit device-webapi-request with an arbitrary URL, making FUXA fetch it server-side and broadcast the response body back.

- Payout: Research
- Severity: high
- Program: FUXA
- Found by: adrgs, aisafe-bot
- Disclosed: 2026-06-08
- CVE: CVE-2026-47719
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-w86f-rf9w-h3x6
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-w86f-rf9w-h3x6
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:nodejs tech:websocket technique:source-review vuln:access-control vuln:auth-bypass vuln:ssrf

**Target:** Socket.IO runtime handlers (DEVICE_WEBAPI_REQUEST, DEVICE_PROPERTY) in fuxa-server
**Root cause:** The DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers omit the isSocketWriteAuthorized() check used by other write events, and pass attacker-controlled property.address/endpoint straight to axios.get and OPC UA/ODBC connect paths.
**Steps:**
1. Connect to FUXA's Socket.IO endpoint without credentials (guest token auto-issued even when secureEnabled=true).
2. Emit `device-webapi-request` with `property.method='GET'` and `property.address` set to a target URL such as the cloud metadata endpoint.
3. Handler at server/runtime/index.js:296 calls `axios.get(property.address)` and `io.emit`s the response body back on the same event.
4. Read the response body from the broadcast event to exfiltrate metadata/IAM credentials or internal service responses.
5. Alternatively emit `device-property` with endpoint/type to reach OPC UA servers or ODBC databases, supplying uid/pwd for the ODBC connection string.
**How found:** Code review of Socket.IO event handlers: noticed DEVICE_VALUES and DEVICE_ENABLE call isSocketWriteAuthorized() while DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY do not, then traced property.address to axios.get and io.emit response echo.
**Exploitation:** Alice connects unauthenticated, emits the event with an arbitrary address, and receives the full HTTP response body via io.emit broadcast; ODBC variant lets her supply credentials to authenticate to any reachable ODBC server trusting the FUXA host.
**Escalation:** Read-SSRF oracle against internal OPC UA servers, ODBC databases, admin consoles, and cloud instance metadata (IAM credential theft) on OT/SCADA networks.
**Insight:** When auditing Socket.IO/websocket apps, diff every event handler against the ones that do call the auth helper; a single missing isSocketWriteAuthorized() on a handler that echoes results via io.emit turns into a full read-SSRF oracle, and guest-token auto-issue defeats secureEnabled.